← Regulations / Mali / Operating Models / CEX

Centralized exchange in Mali

Order-book exchange that takes custody of user assets and matches trades between users.

Conditional AI-Generated · Unreviewed

CEX is conditionally permitted in Mali without local incorporation, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
No
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • Customer identification and verification (name, address, date of birth, nationality, ID number via official documents) per Law N°2018-024 implementing UEMOA Directive No. 02/2015/CM/UEMOA
  • Beneficial ownership identification — identifying and verifying the natural persons who ultimately own or control the customer
  • Understanding the purpose and intended nature of the business relationship
  • Ongoing monitoring of transactions throughout the business relationship
  • Risk-based approach — enhanced due diligence for PEPs, high-risk jurisdictions, and complex transactions
  • Suspicious transaction reporting (STR) to CENTIF (Cellule Nationale de Traitement des Informations Financières) — Mali's FIU — for any transaction suspected of ML/TF
  • No tipping-off prohibition on disclosing STRs to customers or third parties
  • Record-keeping: transaction records and CDD records must be retained for at least 5 years after the business relationship ends
  • Travel-rule-equivalent: transaction records must include originator and beneficiary details (amount, currency, date, parties)

Key Restrictions

  • Centralized exchanges cannot operate within the formal regulated financial sector — BCEAO Circular N°0000000001/M/DG/2021 explicitly prohibits financial institutions from engaging in any virtual asset activities
  • Cryptocurrencies are not recognized as legal tender in the UEMOA zone and are not regulated or supervised by the BCEAO or any national financial authority
  • No dedicated crypto/VASP licensing or registration regime exists — entities operate outside any recognized regulatory framework
  • Financial institutions supervised by the BCEAO (banks, microfinance institutions) are prohibited from offering crypto services
  • Operating a centralized exchange would likely be deemed unauthorized or non-compliant with BCEAO directives and expose the operator to enforcement risk

Key Risks

  • High enforcement risk — BCEAO prohibition on financial institution crypto activity combined with active criminal prosecution of crypto-related fraud (arrests and investigations reported in May 2023)
  • Regulatory ambiguity — no formal VASP framework means operators are neither licensed nor prohibited de jure for non-financial institutions, but de facto the BCEAO stance creates material legal risk
  • No custody rules exist — segregation of client assets, cold storage mandates, insurance/bonding requirements are undefined, exposing operators and users to full loss risk
  • Reputational and criminal exposure — crypto activity is publicly associated with scams and pyramid schemes in Mali, increasing PR risk and potential for criminal prosecution
  • Travel rule cannot be implemented via a recognized framework — no FATF-compliant VASP regime is transposed for crypto

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 60% confidence

December 2021: The BCEAO issued a directive (Circular N°0000000001/M/DG/2021) explicitly prohibiting financial institutions under its purview from engaging in any activities related to virtual assets.

licensing 60% confidence

They are not recognized as legal tender within the UEMOA zone.

licensing 60% confidence

They are not regulated or supervised by the BCEAO or any national financial authority in the region.

licensing 60% confidence

Financial institutions supervised by the BCEAO (banks, microfinance institutions) are generally prohibited or strongly discouraged from engaging in activities related to virtual assets due to the associated risks (money laundering, terrorist financing, consumer protection, financial stability).

licensing 60% confidence

None specifically for crypto. Since there is no dedicated crypto regulatory framework, there are no specific licenses for these activities.

licensing 60% confidence

Neither a registration nor a specific licensing regime currently exists for VASPs in Mali.

licensing 60% confidence

Entities operating in this space are doing so outside of a recognized regulatory framework. This is not a "light touch" approach; rather, it indicates a lack of formal permission or supervision, which can be interpreted as implicitly disallowed for formal financial sector participation.

Evidence fact ml.custody.no-specific-custodial-license-requirements-for not found (may have been renamed).

custody 40% confidence

No specific rules exist for the segregation of client assets for cryptocurrency custodians. This is due to the absence of a dedicated regulatory framework for crypto custody.

custody 40% confidence

No specific cold storage mandates or any other operational security requirements are legally defined for cryptocurrency custody in Mali.

aml 40% confidence

Law N°2018-024 of August 21, 2018, amending Ordinance N°2015-032/P-RM of June 19, 2015, relating to the fight against money laundering and terrorist financing.

aml 40% confidence

Customer Identification and Verification:

aml 40% confidence

Beneficial Ownership Identification: Identifying and verifying the natural persons who ultimately own or control the customer, or the natural person on whose behalf a transaction is being conducted.

aml 40% confidence

Purpose and Nature of Business Relationship: Understanding the purpose and intended nature of the business relationship or occasional transaction.

aml 40% confidence

Ongoing Monitoring: Conducting ongoing due diligence on the business relationship and scrutinizing transactions undertaken throughout the course of that relationship to ensure consistency with the institution’s knowledge of the customer, their business, and risk profile.

aml 40% confidence

Risk-Based Approach: Applying enhanced due diligence (EDD) for higher-risk customers (e.g., politically exposed persons - PEPs, customers from high-risk jurisdictions, or those engaged in complex/unusual transactions) and simplified due diligence (SDD) for lower-risk scenarios.

aml 40% confidence

Obligation: Any transaction (regardless of amount) that an institution knows, suspects, or has reasonable grounds to suspect is related to money laundering or terrorist financing must be reported.

aml 40% confidence

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or third parties that an STR has been filed or that a money laundering or terrorist financing investigation is being conducted.

aml 40% confidence

Transaction Records: All transaction data, including the amount, currency, date, and details of the parties involved (originator and beneficiary), should be kept.

aml 60% confidence

Cellule Nationale de Traitement des Informations Financières (CENTIF): Mali's FIU, responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs).

enforcement 50% confidence

Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a centralized exchange operating in Mali faces a de facto ban within the formal financial sector due to BCEAO prohibitions on financial institutions engaging with virtual assets, and no licensing framework exists; however, operation entirely outside the regulated financial system carries high enforcement and criminal risk, with general AML obligations (CDD, STR to CENTIF, record-keeping) still applicable under Malian law.

Questions this verdict aims to answer

  • What exchange / VASP license applies?
  • What custody segregation rules apply to user assets?
  • What market-conduct and listing rules apply?
  • What travel-rule obligations apply on withdrawals?